Home Directories

The users home directories reside on a Solaris server and are shared out via NFS. The home directories, are therefore, automounted upon logging into the Ubuntu machine.

instructions for automounting home directories are contained in the Setting Up NFS page

Remote Mounts

Similar to the home directories, the Solaris server contains multiple shares available over NFS.

instructions for statically mounting shares at boot are contained in the Setting Up NFS page

Printing

The Ubuntu printing setup has disabled the use of CUPS for administration of printers due to security reasons. A current oversight made by the developers involved in the Ubuntu printing interface is the lack of the ability to name/rename printers. The printers are named after the printer model name and it is not scalable in a large environment where several printers of the same model may exist.

A workaround is to rename the entry made in /etc/cups/printers.conf and create a symbolic link to the printer model PPD file in the /etc/cups/ppd directory. Below is a script that can be installed into /usr/bin and run immediately after setting up a printer:

After a new printer is added to the system, the script can be run as follows:

ncampbell@naaman:~$ sudo changeprintername old_name new_name

It is possible to subvert the measures setup by the Ubuntu printing team to enable access into the Cups administration web pages. By adding the cupsys user into the shadow group, the cupsys user is able to edit the necessary printing system files. Change the shadow group line in /etc/group to include the cupsys user:

ncampbell@naaman:~$ sudo vi /etc/group
shadow:x:42:cupsys

Locale

During initial testing, it appeared that the locale was not being set correctly after logging into GNOME. The locale issue appears to be a user-specific problem from when users used to log on to a Java Desktop System (JDS) - Solaris 10 machine. Ubuntu provides adequate language configuration during the installation process. If additional languagues need to be added or the default GNOME language needs to be changed, use the Language Selector program:

ncampbell@naaman:~$ sudo /usr/bin/gnome-language-selector

Keyboard

Part of configuring Ubuntu for corporate use is locking down the desktop. Limiting the number of keyboard shortcuts, and limiting configuration of shortcuts, is part of restricting access to sections of GNOME.

Adapted from the UbuntuOnSunRay wiki, listed below are a set of suggested shortcuts to be made available to users:

Launch help browser - Help*

Lock screen - "Moon"*

Home folder - Open*

Search - Find*

Take a screenshot - Print

Take a screenshot of a window - <Alt>Print

Close window - <Alt>F4

Move between windows with popup - <Alt>Tab

Switch to workspace on the left - <Control><Alt>Left

Switch to workspace on the right - <Control><Alt>Right

(* denotes Sun Keyboard specific keys - could be mapped to other keys on other keyboards)

To forcibly set the shortcuts, the use of the gconftool-2 command needs to be used. Follow the procedures listed on the UbuntuOnSunRay wiki - Keyboard Shortcuts - as a guide on how to lockdown keyboard shortcuts.

User Login Script

In some sections below, a need arises for a login script to ensure uniform configuration of user profiles logging into the customized system. The steps below outline how to setup a wrapper script for /usr/bin/gnome-session, which is executed on login, and a complete example gnome-session-wrapper script is attached - gnome-session-wrapper:

The wrapper script may contain unwanted components, such as the Mozilla -> Evolution migration section, which should be removed from the script if it is not needed.

Locking Down GNOME

It appears that the GNOME team has withdrawn the setup of the lockdown configuration that was present in GNOME 2.6. The lockdown setup was also undesirable as it did not allow users to drag and drop shortcuts from the GNOME menu onto the desktop or menu bar.

The current concerns of the lockdown procedures are ensuring a consistent look-and-feel across all desktops and setting minor options for users. The look-and-feel is controlled by the three areas: theme, background and screensaver.

Look and Feel

Theme and background are controlled by the gconf database and can be enforced system-wide. The Clearlooks theme was selected to replace the somewhat initially unfavorable brown Human theme. Clearlooks coupled with a background consisting of a 150x150 company logo on a dark-to-light grey vertical gradient, makes for a clean looking desktop. Prior to performing the gconftool-2 commands below, ensure all users are logged out of GNOME (perform commands from text console or a remotely logged-in session):

Screensaver

Screensaver configuration is separate to the gconf system and is configured system-wide via /etc/X11/app-defaults/XScreenSaver. Although a system-wide file exists, users are still able to change the settings by setting up a .xscreensaver file within their home directories. A suggested method of locking down the screensavers is to "mv" the screensaver files from /usr/lib/xscreensaver to another directory and to create a symbolic link to /etc/X11/app-defaults/XScreenSaver named .xscreensaver under the user's home directory upon logging in to GNOME.

The means for creating the .xscreensaver for the user can be performed inside the gnome-session-wrapper script:

In a thin-client environment, it is recommended that a blank screensaver is used due to the amount of load needed to serve the video. The following /etc/X11/app-defaults/XScreenSaver-gl contains configuration suitable for a thin-client environment - XScreenSaver-gl.

Default Settings

The minor settings that can form part of locking down the environment include changing the default archive extension to .zip and the configuration of sound settings within GNOME to turn on sound and turn off sound events. Once again, prior to performing these gconftool-2 commands, ensure all users are logged out of GNOME:

Email

The current email client used on the Solaris desktops is Mozilla Mail 1.4. Email is currently using POP to transfer emails and will continue to use POP from within Evolution. POP-to-IMAP changeover will occur at a later date.

When users log in to GNOME, an addition to the gnome-session-wrapper script can check if the user has an existing evolution profile and migrate the user's Mozilla mail into Evolution. The additional section of gnome-session-wrapper performs the following:

creates and initializes a minimal evolution profile

moves the email into the correct sections of the new profile

prepares the moved files for first usage

Note: this method can result in a very long delay when the user first logs in if the user has a large email directory.

The script requires installing and configuring ssmtp & mailx to email the system administrator errors that may arise in the migration process. To install ssmtp and mailx you need to install the ssmtp package from the Universe Repository and the mailx package. Then you need to edit the /etc/ssmtp/ssmtp.conf file to your specifications.

At present, address books cannot be migrated on the command line and are going to be done manually. A solution does exist as documented here - Web-based mab2ldif conversion tool. The authors have been contacted to obtain the source.

Word Processing Suite

The OpenOffice2 suite of applications offers vast improvements over the currently used StarOffice7. OpenOffice2 provides a method for using the GTK file chooser dialogs and, although it does not have the language support of StarOffice7, methods are available for setting up language tools to suit different regions.

The following instructions are useful in environments that don't require the EN-US locale.

Obtain the dictionary, hyphenation dictionary and the thesaurus for the desired language from the OpenOffice Writing Aids site. Save the files into a new folder named langtools, extract the archives and move the files into the /usr/lib/openoffice2/share/dict/ooo directory:

Instructions below are for Australian English

British English is the closest English offering a hyphenation dictionary

To set the correct locale & dictionaries along with changing to use the GTK file chooser dialogs, user configuration needs to be changed. A suggested way of setting up user configuration for OpenOffice2 is to store base configuration files in a common location and copy the files into the user directory upon login.

The attached files: Common.xcu, Linguistic.xcu and Setup.xcu are to be saved to the common location and the following amendment to the /usr/bin/gnome-session-wrapper script needs to be made:

Terminals

A requirement of the migration was to provide access to multiple terminal-based systems via gnome-terminal. A scalable method of managing different terminals for different systems was to create the gnome-terminal profiles globally (within gconf) and provide launchers in a custom Applications menu to allow users to drag-and-drop desired launchers to their desktops/panels.

The gnome-terminal profiles were built by changing the settings using Edit -> Profiles. Settings changed included colours and the disabling of the F1 key to allow F1 to be used within certain applications. Once the settings has been configured for the current user, the configuration was exported to XML then applied globally using gconftool-2. Ensure all users are logged out prior to performing the following:

To display .desktop entries in the Applications menu, it must belong to a legitimate Category relating to the Directory entry. An entry needs to made into /etc/xdg/menus/applications.menu to assign a category to the CompanyName directory entry:

Prior to populating the menu with items, a copy of the company logo was altered and placed into the right location as an icon for the new menu. The logo was set onto a transparent background, resized to 32x32 pixels and saved as a PNG using the GIMP. The icon was then copied to /usr/share/pixmaps:

ncampbell@naaman:~$ sudo cp company-logo.png /usr/share/pixmaps/.

The final step involves creating the Desktop entry files to fill the new menu. Desktop files created with the CompanyName category will appear under the Applications -> Company Name menu.

* /usr/bin/prodsys is a wrapper script to execute a gnome-terminal command - 'gnome-terminal --window-with-profile=sydprod -e ssh syd' would be executed

The new desktop entry should now appear under the new menu. Repeat the Desktop entry step for the remainder of terminals required.

Multimedia

Gxine

Running sound over a thin-client architecture requires solely relying on the ESD sound system. After extensive testing of multiple multimedia players, gxine came out as the clear winner. gxine provides GTK file dialogs and supports additional codecs and the ESD system with minimal configuration. Further information about the installation of additional codecs is available from the RestrictedFormats wiki. gxine can be installed by installing the gxine package.

To ensure all users have the same configuration for all users, a setup similar to the xscreensaver configuration is needed. The setup, however, does not prevent users from recreating the .gxine directory, but will reset the configuration each time at login.

Perform the following steps to setup an initial configuration file:

open gxine and follow the wizard

"~/.mailcap" and "KDE / Konqueror" options can be unchecked

File -> Preferences

[gui] experience_level = Advanced

[audio] [] driver = esd

After setting up the desired configuration for the current user, copy the configuration file to a shared common location and setup the following addition to the gnome-session-wrapper script:

Adobe Acrobat

To complement evince, Adobe Acrobat was installed to provide full PDF support by installing the acroread and mozilla-acroread packages from the Multiverse repositories.

Macromedia Flash

To complete the multimedia setup, Macromedia Flash can be installed by installing the flashplugin-nonfree package from the Mulitverse Repository.

An issue related to the installation of the flash plugin is the lack of multiple user sound support. On a single-user system, creating a symlink to the esd library in the right location can fix the issue. Multiple user systems (and it seems newer versions of esd on single-user machines) use a multiple esd socket file system. When a user logs on, a new socket is created under /tmp/.esd for the user. The Macromedia Flash plugin has the /tmp/.esd/socket file location hardcoded and a workaround is not possible at present.

In short, Macromedia Flash sound is not possible in a multiple user environment.

GNOME Menu

Although the GNOME menu system has improved greatly in 2.12, there still is a lack of a tool for editing the GNOME menu on a system-wide basis. GNOME menu configuration, therefore, still needs to be edited on the command line.

The GNOME menu consists of a collection of desktop files in the /usr/share/applications directory. Inside each file is a Categories line which determines where the menu entry exists. A small number of system tool desktop files exist in /usr/share/control-center-2.0/capplets.

The first step in "trimming the fat" from the GNOME menu is to create a disabledapps directory under /usr/share/applications:

The process of removing the unwanted entries consisted of moving the desktop files into /usr/share/applications/disabledapps then adding the "NoDisplay=true" line to each file. Below is a listing of the apps that currently exist in the disabledapps directory:

Attached is a copy of this listing, however it does not contain the entries that usually reside under /usr/share/control-center-2.0/capplets - disabledapps. Save the disabledapps file and execute the following:

A suggested method for administrators to regain access to some of the removed apps is to run smeg on the command-line and add the desired apps to the current user only.

Time/Date

The default configuration for ntpdate is to synchronise the system time with ntp.ubuntulinux.org when starting up. Problems arise when this is attempted inside a proxied/firewalled network. A workaround to this issue is to point NTP clients to internal NTP servers which update from external NTP servers. To change what server an Ubuntu machine points to, change /etc/default/ntpdate:

Remote Desktop

A large advantage over the current CDE environment is the ability to remotely control a user's desktop using VNC. A problem arises, however, when trying to locate which user has which VNC desktop. When a user runs System -> Preferences -> Remote Desktop a link is displayed showing how to connect to the user's display. This display always appears to be display 0 and not the user's real display.

The vineyard script, vineyard, can be installed into the /usr/share/company directory to match users with their displays. Placing the script in another directory other than /usr/bin prevents a conflict occuring with another similarly named package.